Risk Matrix Setup

Folio supports 3 types of risk matrices. 

To set up your Risk Matrix, go to the Admin Gearwheel and then click on Risk Matrix Setup.

Select the Risk Matrix Type, that your Organisation uses from the following options: 

1. One Risk Matrix:

Likelihood X Consequence = Risk Rating

1. Two Risk Matrix (control rating based):

Likelihood X Consequence = Inherent Risk

Inherent Risk X Control Rating = Residual Risk

1. Two Risk Matrix (Likelihood and Consequence based):

Likelihood x Consequence = Inherent Risk (Risk before controls) 

Likelihood x Consequence = Residual Risk (Risk after controls) 

Once you have selected the Risk Matrix Type, you can configure the risk matrix to reflect your Organisation's Risk Framework. If you click on the cells of the matrix you can change the risk rating associated with that particular level of likelihood and consequence. Click on the tick to save. 

Likelihood, Consequence Inherent Risk, Residual Risk, Risk Rating and Control Rating Definitions

Your next step will be to edit the definitions of Likelihood, Consequence, Inherent Risk, Residual Risk, Risk Rating (used with One Risk Matrix) and Control Rating. To do this, click on each parameter's tab.

Click on the Title or Definition to edit them, and use the drag handles on the left to rearrange the order.

Changing the colours of the Risk Ratings

You can also change the colours on your risk matrix to suit your Organisation. Select the Risk Ratings Tab, or the Inherent Risk or Residual Risk tab.

Two Risk Matrix (Control Ratings based)	All other risk matrices

Click on the colour of the rating you would like to change and select a different colour or type in the HTML colour code of your choice. To find the HTML colour code, go to any HTML colour picker online (e.g: HTML Color codes).

Click on the tick to Save.

Making Changes to your Risk Matrix

The following changes of to your risk matrix will require you to reassess all risks in your risk registers for the change to take effect. You reports will reflect incorrect information until the risks are reassessed. 

• Changing the Risk Matrix Type
• Changing the Risk Matrix (i.e. The Risk Rating derived from a combination Likelihood and Consequence or a combination of Inherent Risk & Control Rating.)
• Adding/Removing/Rearranging the Consequence, Likelihood, Control Rating, Inherent Risk, Residual Risk, Risk Rating

Folio will warn you before you apply these changes to the Risk Matrix with this modal you will need to confirm, confirming will require you to reassess all risks in your register

You can make the following change to your risk matrix without reassessing all risks: 

• Changing Titles or Definitions of Consequence, Likelihood, Control Rating, Inherent Risk, Residual Risk, Risk Rating and Target Risk.
• Changing Colours of an Inherent Risk Rating, Residual Risk Rating or Risk Rating. 

Target Risk

If your risk management process uses Target Risk, Which lets you set the desired optimal level of risk, You can enable this by setting Target Risk to Yes. 

Then when a user is assessing a risk they will see the Target Risk slider, which allows them to set the target risk. 

By Default the Target Risk Definitions will match the Risk Ratings/Residual Risk Definitions, if you have different definitions for your target risks you set Target Risk Definition Enabled to Yes, and then on the Risk Ratings/Residual Risk Tab you will see the Target Risk Definition which you can fill with the definition for each Target Risk Rating.